CVE-2020-11934: fallo de gravedad media en Canonical snapd
Sandbox escape vulnerability via snapctl user-open (xdg-open)
Publicada el · Actualizada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.9epss 0.4%
probabilidad de explotación
0.4%top 72% de las CVE
explotación observada
noninguna fuente lo reporta
It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Productos afectados
Canonical · snapdCVEs relacionadas — Canonical snapd
En el mismo producto, de las más peligrosas a las menos.
CVE-2019-7304HIGHLocal privilege escalation via snapd socketEPSS 60.8%CVE-2019-7303MEDIUMSnapd seccomp filter TIOCSTI ioctl bypassEPSS 3.7%CVE-2024-29069MEDIUMsnapd will follow archived symlinks when unpacking a filesystemEPSS 0.2%CVE-2020-11933HIGHlocal snapd exploit through cloud-initEPSS 0.2%CVE-2024-29068MEDIUMsnapd non-regular file indefinite blocking readEPSS 0.2%